PortSwigger / BChecks

BChecks collection for Burp Suite Professional and Burp Suite Enterprise Edition
https://portswigger.net/burp/documentation/scanner/bchecks
GNU Lesser General Public License v3.0
588 stars 104 forks source link

Add bcheck for csrf-magic backdoor #194

Closed timoles closed 2 months ago

timoles commented 3 months ago

BCheck to detect a csrf-magic backdoor.

References:

BCheck Contributions

Example output for finding:

Overview

image

Request

image

Response

image
Hannah-PortSwigger commented 3 months ago

Thanks for the submission!

Does a valid response for this vulnerability always contain a 200 response code? If so, adding an additional clause to your if... then statement can mean that we can only perform the "expensive" regex match when necessary.